US9032478B2 - Managing security in a network - Google Patents
Managing security in a networkDownload PDFInfo
- Publication number
- US9032478B2 US9032478B2US13/146,112US200913146112AUS9032478B2US 9032478 B2US9032478 B2US 9032478B2US 200913146112 AUS200913146112 AUS 200913146112AUS 9032478 B2US9032478 B2US 9032478B2
- Authority
- US
- United States
- Prior art keywords
- source
- network
- access control
- control policies
- access
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active, expires
Links
Images
Classifications
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H04L63/102—Entity profiles
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1416—Event detection, e.g. attack signature detection
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
- H04L2463/146—Tracing the source of attacks
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H04L63/107—Network architectures or network communication protocols for network security for controlling access to devices or network resources wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
Definitions
- the field of the present inventionrelates to computing systems. More particularly, embodiments of the present invention relate to network security management.
- FIG. 1is a block diagram of an example network in which a network security system may be implemented, in accordance with embodiments of the present technology.
- FIG. 2is a block diagram of an example network security system, in accordance with embodiments of the present technology.
- FIG. 3is a flowchart of an example computer-implemented method of managing security in a network, in accordance with embodiments of the present technology.
- FIG. 4is a diagram of an example computer system used for managing security in a network, in accordance with embodiments of the present technology.
- FIG. 5is a flowchart of an example method of managing security in a network, in accordance with embodiments of the present technology.
- Embodiments in accordance with the present technologypertain to a system for managing security in a network and its usage.
- the system described hereinenables the prevention of disruptive network traffic, such as but not limited to, viruses, worms, spiders, crawlers, and Trojans. More particularly, the system detects disruptive network traffic at a first network location, identifies the source of the disruptive network traffic, and restricts the source's ability to circumvent the security system and re-enter the network at a second network location.
- a userlogs into the local network via the user's desktop computer and a first port.
- a wormhas infiltrated the desktop computer.
- the wormhas already begun its work of creating network bandwidth issues, thereby disrupting local network traffic.
- a network management systemdetects the intrusion of the worm and takes mitigation measures, such as denying the user access to the local network via the first port.
- the userunplugs his desktop computer from the first port and plugs it into a second port. The user then attempts to log into the local network via the second port.
- embodiments of the present technologyprovide that the user's access to the local network via the second port may also be restricted, based on the identification of the user's network address while using the first port as well as an access control policy associated with the user.
- the wormwas detected at user's desktop computer via port 1 of the local network.
- the source of the wormwas identified, a.k.a., the user's network address.
- an access control policymay provide that the identified user network address associated with the data anomaly is to be denied access to the entire local network, regardless of which network port may be used.
- the useris also denied access to the local network via the second port.
- embodiments of the present technologymanage security in a network by applying automated preventative measures to avoid re-entry into a network at a location by a previously recognized disruptive source.
- embodiments of the present technologyprovide a method for preventing a user from circumventing mitigation measures responsive to network traffic disruptions traced to a first network location, such preventative measures including blocking the user from re-entering the network at a second network location.
- FIG. 1is a block diagram representation of an example of a network 100 where one embodiment of managing security in a network 100 may be implemented is shown.
- the example network 100generally includes first, second and third network switch systems 102 , 104 , 106 , a network administrator system 108 , a network management system 110 , first, second and third server systems 112 , 114 , 116 , and first, second, third and fourth threat assessment systems 118 , 120 , 122 , 124 .
- An external system 128such as a laptop, is communicatively coupled with network 100 .
- First, second and third network switch systems 102 , 104 , 106are communicatively coupled with each other and generally communicatively coupled with network 100 .
- Each of first, second and third network switch systems 102 , 104 , 106respectively, includes a plurality of data ports 1 , 2 , 3 , 4 , 5 , 6 .
- Communicative couplingis established between first network switch system 102 and second network switch system 104 via a communication channel between data port 6 of first network switch system 102 and data port 2 of second network switch system 104 .
- Communicative couplingis established between second network switch system 104 and third network switch system 106 via a communication channel between data port 1 of second network switch system 104 and data port 6 of third network switch system 106 .
- one or more network switch systems 102 , 104 , 106includes one or more edge interconnect data ports.
- Data port 1 of first network switch system 102is communicatively coupled with external system 128 and is an example of an edge interconnect data port.
- one or more network switch systemsare configured as edge interconnect network switch systems where the data ports 1 , 2 , 3 , 4 , 5 , 6 are all configured as edge interconnect data ports.
- one or more network switch systems 102 , 104 , 106includes an embedded threat assessment system in the form of a switch based trap system.
- the switch based trap systemis configured to detect one or more selected data anomalies and raises a data anomaly event upon detection of the one of the selected data anomalies.
- the switch based trap systemissues an anomaly notification to network management system 110 upon detection of one of the selected data anomalies.
- the switch based trap systemissues an anomaly notification to network administrator system 108 upon detection of one of the selected data anomalies.
- the switch based trap systemis a virus throttling (VT) system.
- VTvirus throttling
- one or more data ports, 1 , 2 , 3 , 4 , 5 , 6 of one or more of network switch systems 102 , 104 , 106are configured as mirror source ports. In one embodiment, one or more data ports 1 , 2 , 3 , 4 , 5 , 6 of one or more network switch systems 102 , 104 , 106 are configured as mirror destination ports. In one embodiment, one or more data ports 1 , 2 , 3 , 4 , 5 , 6 of one or more network switch systems 102 , 104 , 106 are configured as local mirror source ports.
- one or more data ports 1 , 2 , 3 , 4 , 5 , 6 of one or more network switch systems 102 , 104 , 106are configured as local mirror destination ports. In one embodiment, one or more data ports 1 , 2 , 3 , 4 , 5 , 6 of one or more network switch systems 102 , 104 , 106 are configured as remote mirror source ports. In one embodiment, one or more data ports 1 , 2 , 3 , 4 , 5 , 6 of one or more network switch systems 102 , 104 , 106 are configured as remote mirror destination ports.
- network switch systems having six data portshave been described, network switch systems used in a network may have a fewer or a greater number of data ports. For example, many network switch systems have well over 100 data ports. Also, while a number of different types of network switch systems having the described configurations and/or features have been described, the network switch systems may be configured using alternative network switch system configurations and/or features. Furthermore, while a network has been described as having three network switch systems, a fewer or greater number of network switch systems may be used.
- Threat assessment systems 118 , 120 , 122 , 124generally monitor network data to identify data anomalies that may pose a security threat to network 100 and evaluate any identified data anomalies.
- threat assessment system 118 , 120 , 122 , 124implements mitigation actions in response to the detection of a data anomaly that may pose a potential security threat to network 100 .
- threat assessment systems 118 , 120 , 122 , 124available for use in network 100 . Examples of such threat assessment systems 118 , 120 , 122 , 124 , include but are not limited to, intrusion detection systems (IDS), intrusion prevention systems (IPS), unified threat management (UTM) systems and firewall systems (FW).
- IDSintrusion detection systems
- IPSintrusion prevention systems
- UDMunified threat management
- FWfirewall systems
- first and third threat assessment systems 118 and 122are intrusion detection systems (IDS)
- second threat assessment system 120is an intrusion prevention system (IPS)
- fourth threat assessment system 124is a unified threat management (UTM) system.
- IDSintrusion detection systems
- IPSintrusion prevention system
- UDMunified threat management
- First and second threat assessment systems 118 and 120are communicatively coupled with network 100 via first network switch system 102 and third and fourth threat assessment systems 122 and 124 , respectively, are communicatively coupled to network 100 via second and third network switch systems 104 and 106 , respectively. More specifically, first threat assessment system 118 is communicatively coupled with network 100 via a communication channel between first threat assessment system 118 and data port 2 of first network switch system 102 . Second threat assessment system 120 is communicatively coupled with network 100 via a communication channel between second threat assessment system 120 and data port 5 of first network switch system 102 . Third threat assessment system 122 is communicatively coupled with network 100 via a communication channel between third threat assessment system 122 and data port 6 of second network switch system 104 . Fourth threat assessment system 124 is communicatively coupled with network 100 via a communication channel between fourth threat assessment system 124 and data port 5 of third network switch system 106 .
- one or more threat assessment systems 118 , 120 , 122 , 124issues an anomaly event notification to network administrator system 108 upon the detection of selected data anomalies. In one embodiment, one or more threat assessment systems 118 , 120 , 122 , 124 issues an evaluation notification to network administrator system 108 upon completion of an evaluation of a detected data anomaly. In one embodiment, one or more threat assessment systems 118 , 120 , 122 , 124 issues an anomaly event notification to network management system 110 upon the detection of a data anomaly. In one embodiment, one or more threat assessment systems 118 , 120 , 122 , 124 issues an evaluation notification to network management system 110 upon completion of an evaluation of a detected data anomaly.
- threat assessment systemsWhile a number of different types have been described, other types of threat assessment systems may be used. Also, while a network has been described as having four threat assessment systems, a fewer or greater number of threat assessment systems may be used. Furthermore, while a particular network configuration has been described for the threat assessment systems, alternative network configurations may be employed.
- network management system 110upon the detection of selected data anomalies by network management system 110 , network management system 110 issues a data anomaly assessment request to a selected threat assessment system 118 , 120 , 122 , 124 to provide an assessment of the detected data anomaly. In one embodiment, upon the detection of selected data anomalies by network management system 110 , network management system 110 issues a data mirroring command to a selected network system to mirror network data associated with the detected data anomaly to a selected threat assessment system 118 , 120 , 122 , 124 .
- network management system 110upon the detection of selected data anomalies by network management system 110 , identifies the threat type posed by the detected network data anomaly, identifies a threat assessment system 118 , 120 , 122 , 124 that specializes in the evaluation of an identified threat type and issues a data mirroring command to a selected network system to mirror network data associated with the data anomaly to the identified threat assessment system 118 , 120 , 122 , 124 .
- Network management system 110generally manages network operations including network security operations.
- network management system 110includes a network immunity management system where the network immunity management system generally manages network security operations.
- network management system 110is a network immunity management (NIM) system type of network management system that generally manages network security operations. Additional types of network management systems are used to manage other types of network operations.
- network management system 110includes an embedded threat assessment system.
- the embedded threat assessment systemis a network behavior anomaly detection (NBAD) system.
- Network management system 110is communicatively coupled with network 100 via second network switch 104 . More specifically, network management system 110 is communicatively coupled with network 100 via a communication channel between network management system 110 and data port 5 of second network switch system 104 . Network management system 110 will be described in greater detail with reference to FIG. 2 below.
- Network administrator 130generally manages network operations including network security operations via network administrator system 108 .
- Network administrator system 108is communicatively coupled with network 100 via third network switch 106 . More specifically, network administrator system 108 is communicatively coupled with network 100 via a communication channel between network administrator system 108 and data port 1 of third network switch system 106 .
- network administrator 130is provided with the option of manually defining and/or amending security policies via network administrator system 108 .
- anomaly notificationsare received at network administrator system 108 .
- network administrator 130is provided with the option of selectively manually enforcing selected security polices via network administrator system 108 .
- network administrator 130is provided with the option of selectively manually implementing one or more mitigation responses to selected data anomalies via network administrator system 108 .
- network administrator 130is provided with the option of configuring selected network systems via network administrator system 108 .
- network administrator 130is provided with the option of configuring individual network switch systems 102 , 104 , 106 via network administrator system 108 . In one embodiment, network administrator 130 is provided with the option of configuring individual data ports 1 , 2 , 3 , 4 , 5 , 6 of individual network switch systems 102 , 104 , 106 via network administrator system 108 . In one embodiment, network administrator 130 is provided with the option of configuring individual data ports 1 , 2 , 3 , 4 , 5 , 6 as mirror source data ports and as mirror destination data ports via network administrator system 108 .
- network administrator 130is provided with the option of configuring individual data ports 1 , 2 , 3 , 4 , 5 , 6 as local mirror source data ports and as local mirror destination data ports via network administrator system 108 . In one embodiment, network administrator 130 is provided with the option of configuring individual data ports 1 , 2 , 3 , 4 , 5 , 6 , as remote mirror source data ports and as remote mirror destination data ports via network administrator system 108 . While a number of different network administrations functions that may be performed by network administrator 130 via network administrator system 108 have been described, other network administrations functions may also be performed by network administrator 130 via network administrator system 108 .
- First server system 112is communicatively coupled with network 100 via third network switch 106 and second and third server systems 114 and 116 , respectively, are communicatively coupled with network 100 via second network switch 104 . More specifically, first server system 112 is communicatively coupled with network 100 via a communication channel between first server system 112 and data port 3 of third network switch system 106 . Second server system 114 is communicatively coupled with network 100 via a communication channel between second server system 114 and data port 3 of second network switch system 104 . Third server system 116 is communicatively coupled with network 100 via a communication channel between third server system 116 and data port 4 of second network switch system 104 .
- first server system 112handles data requiring a relatively low level of network security while second and third server systems 114 and 116 , respectively, handle relatively sensitive financial data and require a relatively higher level of network security. While one network configuration including specific types of server systems configured within the network in a particular manner have been described, other types of server systems may be used in a network. Also, while one network configuration of server systems has been described alternative network configurations may be used. Furthermore, while three servers have been described as a part of the network, a fewer or greater number of servers may be used.
- a user 126has used external system 128 , such as a laptop, to establish communicative coupling with network 100 .
- External system 128has established communicative coupling with network 100 via a communication channel established between external system 128 and data port 1 of first network switch system 102 .
- Data port 1is an edge interconnect data port.
- a user as used in the descriptionincludes human users as well as automated agents. One example of such an automated agent is a bot.
- communication channels established between network systems within network 100are wireless communication channels. In one embodiment, communication channels established between network systems within network 100 are wired communication channels. In one embodiment, communication channels established between network systems within network 100 are a combination of wireless communication channels and wired communication channels.
- communication channels established between external system 128 and network 100are via wireless communication channels. In one embodiment, communication channels established between external system 128 and network 100 are via wired communication channels. In one embodiment, communication channels established between external system 128 and network 100 are via a combination of wireless communication channels and wired communication channels.
- network 100where one embodiment of managing security in network 100 may be implemented has been described, embodiments of managing security in a network may be implemented in networks having alternative configurations. Furthermore, embodiments of managing security in a network may be implemented in networks including a fewer or greater number of types of network systems and including a fewer or greater number of the described network systems.
- FIG. 2is a block diagram of an example network security system (NSS) 111 , in accordance with embodiments of the present technology.
- NSS 111is coupled with, wired and/or wirelessly, network management system 110 and network 100 .
- NSS 112includes anomaly detection module 200 , source identifier 210 , data store 220 , source comparator 230 , and access control policy associator 240 .
- Embodiments of the present technologymay further include mapping module 245 and source authenticator 255 .
- anomaly detection module 200is coupled with, wired and/or wirelessly, the threat assessment system embedded within one or more network switch systems 102 , 104 , and 106 described herein.
- FIG. 2shows network 100 comprising source 215 and data anomaly 205 .
- Source 215refers to the origination of a detected data anomaly 205 .
- source 215is a mechanism used to access a network, and may include a computer only or a computer and its operator.
- Source 205comprises network address 250 .
- Network address 250is recognizable by NSS 111 , and may be used to locate the access control policy that applies to source 215 , as will be described herein.
- data store 220stores comprises a plurality of access control policies 225 a , 225 b , 225 c , 225 d , 225 e , and 225 f ( 225 a - 225 f ).
- Data store 220may be internal to or external to NSS 112 .
- data store 220is coupled with but external to network 100 described herein.
- access control policies 225 a - 225 fWhile a plurality of access control policies, 225 a - 225 f , is shown in FIG. 2 , for purposes of brevity and clarity, only one access control policy, 225 a , will be discussed herein. Furthermore, while a limited number of access control policies, 225 a - 225 f , are shown in FIG. 2 , it is understood that there may be as many access control policies in data store 220 that data store 220 is capable of storing. It is also understood that the description of access control policy 225 a will be representative of all access control policies.
- Access control policy 225 acomprises at least one access restriction instruction 235 a associated with source 205 . While only one access restriction instruction 235 a is described herein, it is understood that access control policy 225 a may contain more than on access restriction instruction. Access restriction instruction 235 a includes a description regarding instructions limiting a source's access to a certain location within a network.
- access restriction instruction 235 amay be a network location restriction for source 215 .
- access restriction instruction 235 amay indicate that source 215 is only permitted access to ports 5 and 6 of the ports 1 , 2 , 3 , 4 , 5 , and 6 .
- access restriction instruction 235 amay be a network bandwidth restriction.
- access restriction instruction 235 amay indicate that source 215 is only permitted to use a pre-specified amount of bandwidth at all ports 1 , 2 , 3 , 4 , 5 , and 6 on network 100 .
- access restriction instruction 235 amay be a duration restriction for source 215 .
- access restriction instruction 235 amay indicate that source 215 is only permitted access to network 100 via port 1 for two minutes a day.
- embodiments of the present technologyprovide a mechanism for detecting anomalous or harmful behavior by users and/or machines and to temporarily or permanently restrict future access rights to the network in order to prevent continued harmful behavior.
- NSS 111is utilized to recognize the source of a network attack at a first location and restrict this source's access to the network at another network location.
- Such a method of managing access to a networkis particularly useful in preventing a user responsible for disruptive network traffic from re-entering the network at a second location and causing more disruption.
- anomaly detection module 200is configured to detect data anomaly 205 at a first location on network 100 .
- First location on network 100may be any location within network 100 that a data anomaly may be detected, such as but not limited to, ports 1 , 2 , 3 , 4 , 5 , and/or 6 .
- source identifier 210is configured to identify a source 215 of data anomaly 205 .
- mapping module 245is configured to map source 215 to an associated network address via technology known in the field.
- source authenticator 255is configured to determine a role associated with source 215 .
- the term, “role”,refers to source 215 's pre-defined function within network 100 , which function corresponds to a source 215 's level of access permitted to various locations within network 100 .
- source authenticator 255recognizes source 215 via source's 215 network address 250 , and determines source's pre-defined role within network 100 . This role may be that of a “manager”. A manager in the corporation may typically be permitted a high level of access at various locations within the network.
- source comparator 230compares source 215 with plurality of access control policies 225 a - 225 f , wherein each of plurality of access control policies 225 a - 225 f comprises at least one access restriction instruction 235 a - 235 f associated with one or mores sources, such as source 215 .
- access control policy associator 240is configured for associating source 215 with a corresponding one of the plurality of access control policies 225 a - 225 f based on source comparator 230 's comparison described herein.
- An access control policy that is “corresponding” with source 215may be one that references source 215 's pre-defined “role” and/or source's network address.
- Associating source 215 with the corresponding access control policy 225 amay entail communicating this corresponding access control policy 225 a to network 100 and an administrator therein. Additionally, access control policy 225 a may become temporarily associated with source 215 or permanently associated with source 215 .
- network 100may be programmed to automatically replace the current access control policy regarding source 215 with the access control policy 225 a .
- network 100 and/or any administrator thereofmay receive access control policy 225 a for examination before determining whether or not to implement it.
- FIG. 3a flowchart of an example computer-implemented method of managing security in network 100 , in accordance with embodiments of the present technology is shown.
- data anomaly 205is detected at a first location on network 100 .
- source 205 of data anomaly 205is identified.
- source 205is compared with a plurality of access control policies 225 a - 225 f , wherein each of plurality of access control policies 225 a - 225 f comprises at least one access restriction instruction 235 a - 235 f associated with one or more sources, such as but not limited to, source 205 .
- source 205is associated with a corresponding one of plurality of access control policies 225 a - 225 f.
- FIG. 4illustrates an example computer system 400 used in accordance with embodiments of the present technology. It is appreciated that system 400 of FIG. 4 is an example only and that embodiments of the present technology can operate on or within a number of different computer systems including general purpose networked computer systems, embedded computer systems, routers, switches, server devices, user devices, various intermediate devices/artifacts, stand alone computer systems, and the like. As shown in FIG. 4 , computer system 400 of FIG. 4 is well adapted to having peripheral computer readable media 402 such as, for example, a compact disc, and the like coupled therewith.
- peripheral computer readable media 402such as, for example, a compact disc, and the like coupled therewith.
- System 400 of FIG. 4includes an address/data bus 404 for communicating information, and a processor 406 A coupled to bus 404 for processing information and instructions. As depicted in FIG. 4 , system 400 is also well suited to a multi-processor environment in which a plurality of processors 406 A, 4068 , and 406 C are present. Conversely, system 400 is also well suited to having a single processor such as, for example, processor 406 A. Processors 406 A, 406 B, and 406 C may be any of various types of microprocessors. System 400 also includes data storage features such as a computer usable volatile memory 408 , e.g. random access memory (RAM), coupled to bus 404 for storing information and instructions for processors 406 A, 406 B, and 406 C.
- RAMrandom access memory
- System 400also includes computer usable non-volatile memory 410 , e.g. read only memory (ROM), coupled to bus 404 for storing static information and instructions for processors 406 A, 406 B, and 406 C. Also present in system 400 is a data storage unit 412 (e.g., a magnetic or optical disk and disk drive) coupled to bus 404 for storing information and instructions. System 400 also includes an optional alpha-numeric input device 614 including alphanumeric and function keys coupled to bus 404 for communicating information and command selections to processor 406 A or processors 406 A, 406 B, and 406 C.
- ROMread only memory
- data storage unit 412e.g., a magnetic or optical disk and disk drive
- System 400also includes an optional alpha-numeric input device 614 including alphanumeric and function keys coupled to bus 404 for communicating information and command selections to processor 406 A or processors 406 A, 406 B, and 406 C.
- System 400also includes an optional cursor control device 416 coupled to bus 404 for communicating user input information and command selections to processor 406 A or processors 406 A, 406 B, and 406 C.
- System 400also includes an optional display device 418 coupled to bus 404 for displaying information.
- optional display device 418 of FIG. 4may be a liquid crystal device, cathode ray tube, plasma display device or other display device suitable for creating graphic images and alpha-numeric characters recognizable to a user.
- Optional cursor control device 416allows the computer user to dynamically signal the movement of a visible symbol (cursor) on a display screen of display device 418 .
- cursor control device 416are known in the art including a trackball, mouse, touch pad, joystick or special keys on alpha-numeric input device 414 capable of signaling movement of a given direction or manner of displacement.
- a cursorcan be directed and/or activated via input from alpha-numeric input device 414 using special keys and key sequence commands.
- System 400is also well suited to having a cursor directed by other means such as, for example, voice commands.
- System 400also includes an I/O device 420 for coupling system 400 with external entities.
- an operating system 422when present, an operating system 422 , applications 424 , modules 426 , and data 428 are shown as typically residing in one or some combination of computer usable volatile memory 408 , e.g. random access memory (RAM), and data storage unit 412 .
- RAMrandom access memory
- operating system 422may be stored in other locations such as on a network or on a flash drive; and that further, operating system 422 may be accessed from a remote location via, for example, a coupling to the internet.
- the present inventionfor example, is stored as an application 424 or module 426 in memory locations within RAM 408 and memory areas within data storage unit 412 .
- Computing system 400is only one example of a suitable computing environment and is not intended to suggest any limitation as to the scope of use or functionality of embodiments of the present technology. Neither should the computing environment 400 be interpreted as having any dependency or requirement relating to any one or combination of components illustrated in the example computing system 400 .
- Embodiments of the present technologymay be described in the general context of computer-executable instructions, such as program modules, being executed by a computer.
- program modulesinclude routines, programs, objects, components, data structures, etc., that perform particular tasks or implement particular abstract data types.
- Embodiments of the present technologymay also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network.
- program modulesmay be located in both local and remote computer-storage media including memory-storage devices.
- FIG. 5is a flowchart of an example method of managing security in a network, in accordance with embodiments of the present technology.
- process 500is carried out by processors and electrical components under the control of computer readable and computer executable instructions.
- the computer readable and computer executable instructionsreside, for example, in data storage features such as computer usable volatile and non-volatile memory. However, the computer readable and computer executable instructions may reside in any type of computer readable medium.
- process 500is performed by NSS 111 of FIG. 2 .
- source 215 of a detected data anomaly 205 at a first location on network 100is determined.
- determining the source of detected data anomaly 205comprises detecting data anomaly 205 at a first location on network 100 and identifying source 215 of data anomaly 205 .
- identifying source 215 of data anomaly 205comprises mapping source 215 to an associated network address 250 . In one embodiment, identifying source 215 of data anomaly 205 comprises determining a role-based authentication of source 215 .
- source 215is compared with plurality of access control policies 225 a - 225 f , wherein each of plurality of access control policies 225 a - 225 f comprises at least one access restriction instruction 235 a - 235 f associated with one or more sources, such as but not limited to, 215 .
- source 215is associated with a corresponding one of plurality of access control policies 225 a - 225 f .
- a first access control policyis replaced with a second access control policy, such as 225 a , wherein the second access control policy is based on the determining of source 215 described herein and in 505 of FIG. 5 .
- First access control policymay be the original access control policy relating to source 215 , or may be the most current access control policy relating to source 215 . In other words, the second access control policy may override any previous access control policy in place.
- embodiments of the present technologyenable the prevention of continued harmful behavior on a network by providing a mechanism for detecting anomalous or harmful behavior by a user and/or a machine and restricting the user and/or the machine's future network access rights.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- General Engineering & Computer Science (AREA)
- Computer Hardware Design (AREA)
- Computer Networks & Wireless Communication (AREA)
- Theoretical Computer Science (AREA)
- Computing Systems (AREA)
- Software Systems (AREA)
- Signal Processing (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Health & Medical Sciences (AREA)
- General Health & Medical Sciences (AREA)
- Virology (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
Description
The field of the present invention relates to computing systems. More particularly, embodiments of the present invention relate to network security management.
Technological advances have led to the use of increasingly larger and complex networks with an ever increasing number of network systems as an integral part of organizational operations. Many network systems routinely receive, process and/or store data of a sensitive and/or confidential nature. Users are often provided with access to a network via external network access points to retrieve and/or exchange data with network systems within the network. The increased use of such external network access points has in many cases rendered networks increasingly vulnerable to attacks by malicious users.
Attacks on networks are growing in frequency and sophistication. The sensitive nature of data that is routinely stored in such networks often attracts malicious users or hackers that seek to gain access to the sensitive data and/or confidential data. In some cases, malicious users seek access to networks and network systems with the intention of corrupting the network and/or network systems. Examples of mechanisms that are often used by malicious users to inflict damage on a network include, but are not limited to, viruses, worms, spiders, crawlers and Trojans.
The increasing frequency of attacks on networks has often led to an increase on the demands made on network administrators to detect, assess, and respond to detected network data anomalies in a timely manner.
The accompanying drawings, which are incorporated in and form a part of this specification, illustrate embodiments of the present technology for a system for managing security in a network and, together with the description, serve to explain principles discussed below:
The drawings referred to in this description should not be understood as being drawn to scale unless specifically noted.
Reference will now be made in detail to embodiments of the present technology, examples of which are illustrated in the accompanying drawings. While the present technology will be described in conjunction with various embodiment(s), it will be understood that they are not intended to limit the present technology to these embodiments. On the contrary, the present technology is intended to cover alternatives, modifications and equivalents, which may be included within the spirit and scope of the various embodiments as defined by the appended claims.
Furthermore, in the following detailed description, numerous specific details are set forth in order to provide a thorough understanding of embodiment of the present technology. However, embodiments of the present technology may be practiced without these specific details. In other instances, well known methods, procedures, components, and circuits have not been described in detail as not to unnecessarily obscure aspects of the present embodiments.
Unless specifically stated otherwise as apparent from the following discussions, it is appreciated that throughout the present detailed description, discussions utilizing terms such as “detecting”, “identifying”, “comparing”, “associating”, “mapping”, “determining”, “enabling”, “replacing”, or the like, refer to the actions and processes of a computer system, or similar electronic computing device. The computer system or similar electronic computing device manipulates and transforms data represented as physical (electronic) quantities within the computer system's registers and memories into other data similarly represented as physical quantities within the computer system memories or registers or other such information storage, transmission, or display devices. Embodiments of the present technology are also well suited to the use of other computer systems such as, for example, optical and mechanical computers.
Embodiments in accordance with the present technology pertain to a system for managing security in a network and its usage. In one embodiment in accordance with the present technology, the system described herein enables the prevention of disruptive network traffic, such as but not limited to, viruses, worms, spiders, crawlers, and Trojans. More particularly, the system detects disruptive network traffic at a first network location, identifies the source of the disruptive network traffic, and restricts the source's ability to circumvent the security system and re-enter the network at a second network location.
For example, a user logs into the local network via the user's desktop computer and a first port. However, unbeknownst to the user, a worm has infiltrated the desktop computer. As the user finishes downloading emails, the worm has already begun its work of creating network bandwidth issues, thereby disrupting local network traffic. In one instance, a network management system detects the intrusion of the worm and takes mitigation measures, such as denying the user access to the local network via the first port. In response to experiencing trouble accessing the local network via the first port, the user unplugs his desktop computer from the first port and plugs it into a second port. The user then attempts to log into the local network via the second port.
However, embodiments of the present technology provide that the user's access to the local network via the second port may also be restricted, based on the identification of the user's network address while using the first port as well as an access control policy associated with the user. For example, the worm was detected at user's desktop computer via port1 of the local network. The source of the worm was identified, a.k.a., the user's network address. Additionally, an access control policy may provide that the identified user network address associated with the data anomaly is to be denied access to the entire local network, regardless of which network port may be used. Thus, based on the user's network address and the related access control policy, the user is also denied access to the local network via the second port.
Therefore, embodiments of the present technology manage security in a network by applying automated preventative measures to avoid re-entry into a network at a location by a previously recognized disruptive source. In other words, embodiments of the present technology provide a method for preventing a user from circumventing mitigation measures responsive to network traffic disruptions traced to a first network location, such preventative measures including blocking the user from re-entering the network at a second network location.
First, second and thirdnetwork switch systems network 100. Each of first, second and thirdnetwork switch systems network switch system 102 and secondnetwork switch system 104 via a communication channel between data port6 of firstnetwork switch system 102 and data port2 of secondnetwork switch system 104. Communicative coupling is established between secondnetwork switch system 104 and thirdnetwork switch system 106 via a communication channel between data port1 of secondnetwork switch system 104 and data port6 of thirdnetwork switch system 106.
In one embodiment, one or morenetwork switch systems network switch system 102 is communicatively coupled withexternal system 128 and is an example of an edge interconnect data port. In one embodiment, one or more network switch systems are configured as edge interconnect network switch systems where the data ports1,2,3,4,5,6 are all configured as edge interconnect data ports.
In one embodiment, one or morenetwork switch systems network management system 110 upon detection of one of the selected data anomalies. In one embodiment, the switch based trap system issues an anomaly notification tonetwork administrator system 108 upon detection of one of the selected data anomalies. In one embodiment, the switch based trap system is a virus throttling (VT) system.
In one embodiment, one or more data ports,1,2,3,4,5,6 of one or more ofnetwork switch systems network switch systems network switch systems network switch systems network switch systems network switch systems
While network switch systems having six data ports have been described, network switch systems used in a network may have a fewer or a greater number of data ports. For example, many network switch systems have well over 100 data ports. Also, while a number of different types of network switch systems having the described configurations and/or features have been described, the network switch systems may be configured using alternative network switch system configurations and/or features. Furthermore, while a network has been described as having three network switch systems, a fewer or greater number of network switch systems may be used.
First and secondthreat assessment systems network 100 via firstnetwork switch system 102 and third and fourththreat assessment systems network 100 via second and thirdnetwork switch systems threat assessment system 118 is communicatively coupled withnetwork 100 via a communication channel between firstthreat assessment system 118 and data port2 of firstnetwork switch system 102. Secondthreat assessment system 120 is communicatively coupled withnetwork 100 via a communication channel between secondthreat assessment system 120 and data port5 of firstnetwork switch system 102. Thirdthreat assessment system 122 is communicatively coupled withnetwork 100 via a communication channel between thirdthreat assessment system 122 and data port6 of secondnetwork switch system 104. Fourththreat assessment system 124 is communicatively coupled withnetwork 100 via a communication channel between fourththreat assessment system 124 and data port5 of thirdnetwork switch system 106.
In one embodiment, one or morethreat assessment systems administrator system 108 upon the detection of selected data anomalies. In one embodiment, one or morethreat assessment systems administrator system 108 upon completion of an evaluation of a detected data anomaly. In one embodiment, one or morethreat assessment systems network management system 110 upon the detection of a data anomaly. In one embodiment, one or morethreat assessment systems network management system 110 upon completion of an evaluation of a detected data anomaly.
While a number of different types of threat assessment systems have been described, other types of threat assessment systems may be used. Also, while a network has been described as having four threat assessment systems, a fewer or greater number of threat assessment systems may be used. Furthermore, while a particular network configuration has been described for the threat assessment systems, alternative network configurations may be employed.
In one embodiment, upon the detection of selected data anomalies bynetwork management system 110,network management system 110 issues a data anomaly assessment request to a selectedthreat assessment system network management system 110,network management system 110 issues a data mirroring command to a selected network system to mirror network data associated with the detected data anomaly to a selectedthreat assessment system network management system 110,network management system 110 identifies the threat type posed by the detected network data anomaly, identifies athreat assessment system threat assessment system
In one embodiment,network administrator 130 is provided with the option of manually defining and/or amending security policies vianetwork administrator system 108. In one embodiment, anomaly notifications are received atnetwork administrator system 108. In one embodiment,network administrator 130 is provided with the option of selectively manually enforcing selected security polices vianetwork administrator system 108. In one embodiment,network administrator 130 is provided with the option of selectively manually implementing one or more mitigation responses to selected data anomalies vianetwork administrator system 108. In one embodiment,network administrator 130 is provided with the option of configuring selected network systems vianetwork administrator system 108.
In one embodiment,network administrator 130 is provided with the option of configuring individualnetwork switch systems network administrator system 108. In one embodiment,network administrator 130 is provided with the option of configuring individual data ports1,2,3,4,5,6 of individualnetwork switch systems network administrator system 108. In one embodiment,network administrator 130 is provided with the option of configuring individual data ports1,2,3,4,5,6 as mirror source data ports and as mirror destination data ports vianetwork administrator system 108. In one embodiment,network administrator 130 is provided with the option of configuring individual data ports1,2,3,4,5,6 as local mirror source data ports and as local mirror destination data ports vianetwork administrator system 108. In one embodiment,network administrator 130 is provided with the option of configuring individual data ports1,2,3,4,5,6, as remote mirror source data ports and as remote mirror destination data ports vianetwork administrator system 108. While a number of different network administrations functions that may be performed bynetwork administrator 130 vianetwork administrator system 108 have been described, other network administrations functions may also be performed bynetwork administrator 130 vianetwork administrator system 108.
Auser 126 has usedexternal system 128, such as a laptop, to establish communicative coupling withnetwork 100.External system 128 has established communicative coupling withnetwork 100 via a communication channel established betweenexternal system 128 and data port1 of firstnetwork switch system 102. Data port1 is an edge interconnect data port. A user as used in the description includes human users as well as automated agents. One example of such an automated agent is a bot.
In one embodiment, communication channels established between network systems withinnetwork 100 are wireless communication channels. In one embodiment, communication channels established between network systems withinnetwork 100 are wired communication channels. In one embodiment, communication channels established between network systems withinnetwork 100 are a combination of wireless communication channels and wired communication channels.
In one embodiment, communication channels established betweenexternal system 128 andnetwork 100 are via wireless communication channels. In one embodiment, communication channels established betweenexternal system 128 andnetwork 100 are via wired communication channels. In one embodiment, communication channels established betweenexternal system 128 andnetwork 100 are via a combination of wireless communication channels and wired communication channels.
While one particular configuration ofnetwork 100 where one embodiment of managing security innetwork 100 may be implemented has been described, embodiments of managing security in a network may be implemented in networks having alternative configurations. Furthermore, embodiments of managing security in a network may be implemented in networks including a fewer or greater number of types of network systems and including a fewer or greater number of the described network systems.
In one embodiment,anomaly detection module 200 is coupled with, wired and/or wirelessly, the threat assessment system embedded within one or morenetwork switch systems
In one embodiment,data store 220 stores comprises a plurality ofaccess control policies Data store 220 may be internal to or external toNSS 112. In one embodiment,data store 220 is coupled with but external to network100 described herein.
While a plurality of access control policies,225a-225f, is shown inFIG. 2 , for purposes of brevity and clarity, only one access control policy,225a, will be discussed herein. Furthermore, while a limited number of access control policies,225a-225f, are shown inFIG. 2 , it is understood that there may be as many access control policies indata store 220 thatdata store 220 is capable of storing. It is also understood that the description ofaccess control policy 225awill be representative of all access control policies.
In one embodiment,access restriction instruction 235amay be a network location restriction forsource 215. For example,access restriction instruction 235amay indicate thatsource 215 is only permitted access to ports5 and6 of the ports1,2,3,4,5, and6. In another embodiment,access restriction instruction 235amay be a network bandwidth restriction. For example,access restriction instruction 235amay indicate thatsource 215 is only permitted to use a pre-specified amount of bandwidth at all ports1,2,3,4,5, and6 onnetwork 100. In one embodiment,access restriction instruction 235amay be a duration restriction forsource 215. For example,access restriction instruction 235amay indicate thatsource 215 is only permitted access tonetwork 100 via port1 for two minutes a day.
As will be described herein, embodiments of the present technology provide a mechanism for detecting anomalous or harmful behavior by users and/or machines and to temporarily or permanently restrict future access rights to the network in order to prevent continued harmful behavior.
More generally, in embodiments in accordance with the present technology,NSS 111 is utilized to recognize the source of a network attack at a first location and restrict this source's access to the network at another network location. Such a method of managing access to a network is particularly useful in preventing a user responsible for disruptive network traffic from re-entering the network at a second location and causing more disruption.
Referring still toFIG. 2 ,anomaly detection module 200 is configured to detectdata anomaly 205 at a first location onnetwork 100. First location onnetwork 100 may be any location withinnetwork 100 that a data anomaly may be detected, such as but not limited to, ports1,2,3,4,5, and/or6.
In one embodiment,source identifier 210 is configured to identify asource 215 ofdata anomaly 205. In one embodiment,mapping module 245 is configured to mapsource 215 to an associated network address via technology known in the field.
In one embodiment, source authenticator255 is configured to determine a role associated withsource 215. In one embodiment, the term, “role”, refers to source215's pre-defined function withinnetwork 100, which function corresponds to asource 215's level of access permitted to various locations withinnetwork 100. For example, source authenticator255 recognizessource 215 via source's215network address 250, and determines source's pre-defined role withinnetwork 100. This role may be that of a “manager”. A manager in the corporation may typically be permitted a high level of access at various locations within the network.
In one embodiment,source comparator 230 comparessource 215 with plurality of access control policies225a-225f, wherein each of plurality of access control policies225a-225fcomprises at least oneaccess restriction instruction 235a-235fassociated with one or mores sources, such assource 215.
In one embodiment, accesscontrol policy associator 240 is configured for associatingsource 215 with a corresponding one of the plurality of access control policies225a-225fbased onsource comparator 230's comparison described herein. An access control policy that is “corresponding” withsource 215 may be one that referencessource 215's pre-defined “role” and/or source's network address. Associatingsource 215 with the correspondingaccess control policy 225amay entail communicating this correspondingaccess control policy 225atonetwork 100 and an administrator therein. Additionally,access control policy 225amay become temporarily associated withsource 215 or permanently associated withsource 215.
In one embodiment,network 100 may be programmed to automatically replace the current access controlpolicy regarding source 215 with theaccess control policy 225a. In another embodiment,network 100 and/or any administrator thereof may receiveaccess control policy 225afor examination before determining whether or not to implement it.
Referring now to300 ofFIG. 3 , a flowchart of an example computer-implemented method of managing security innetwork 100, in accordance with embodiments of the present technology is shown.
Referring to305 ofFIG. 3 and as described herein, in one embodiment of the present technology,data anomaly 205 is detected at a first location onnetwork 100. Referring now to310 ofFIG. 3 and as described herein, in oneembodiment source 205 ofdata anomaly 205 is identified.
Referring to315 ofFIG. 3 and as described herein, in one embodiment,source 205 is compared with a plurality of access control policies225a-225f, wherein each of plurality of access control policies225a-225fcomprises at least oneaccess restriction instruction 235a-235fassociated with one or more sources, such as but not limited to,source 205. Referring now to320 ofFIG. 3 and as described herein, in one embodiment, based on the comparing of315 ofFIG. 3 ,source 205 is associated with a corresponding one of plurality of access control policies225a-225f.
Referring still toFIG. 4 ,optional display device 418 ofFIG. 4 may be a liquid crystal device, cathode ray tube, plasma display device or other display device suitable for creating graphic images and alpha-numeric characters recognizable to a user. Optionalcursor control device 416 allows the computer user to dynamically signal the movement of a visible symbol (cursor) on a display screen ofdisplay device 418. Many implementations ofcursor control device 416 are known in the art including a trackball, mouse, touch pad, joystick or special keys on alpha-numeric input device 414 capable of signaling movement of a given direction or manner of displacement. Alternatively, it will be appreciated that a cursor can be directed and/or activated via input from alpha-numeric input device 414 using special keys and key sequence commands.
Referring still toFIG. 4 , various other components are depicted forsystem 400. Specifically, when present, anoperating system 422,applications 424,modules 426, anddata 428 are shown as typically residing in one or some combination of computer usable volatile memory408, e.g. random access memory (RAM), anddata storage unit 412. However, it is appreciated that in some embodiments,operating system 422 may be stored in other locations such as on a network or on a flash drive; and that further,operating system 422 may be accessed from a remote location via, for example, a coupling to the internet. In one embodiment, the present invention, for example, is stored as anapplication 424 ormodule 426 in memory locations within RAM408 and memory areas withindata storage unit 412.
Embodiments of the present technology may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform particular tasks or implement particular abstract data types. Embodiments of the present technology may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer-storage media including memory-storage devices.
Referring to505 ofFIG. 5 , in one embodiment,source 215 of a detecteddata anomaly 205 at a first location onnetwork 100 is determined. In one embodiment, determining the source of detecteddata anomaly 205 comprises detectingdata anomaly 205 at a first location onnetwork 100 and identifyingsource 215 ofdata anomaly 205.
In one embodiment, identifyingsource 215 ofdata anomaly 205 comprisesmapping source 215 to an associatednetwork address 250. In one embodiment, identifyingsource 215 ofdata anomaly 205 comprises determining a role-based authentication ofsource 215.
Referring now to510 ofFIG. 5 , in one embodiment and as described herein,source 215 is compared with plurality of access control policies225a-225f, wherein each of plurality of access control policies225a-225fcomprises at least oneaccess restriction instruction 235a-235fassociated with one or more sources, such as but not limited to,215.
Referring now to515 ofFIG. 5 , in one embodiment and as described herein, based on the comparing described in510 ofFIG. 5 ,source 215 is associated with a corresponding one of plurality of access control policies225a-225f. In one embodiment, a first access control policy is replaced with a second access control policy, such as225a, wherein the second access control policy is based on the determining ofsource 215 described herein and in505 ofFIG. 5 . First access control policy may be the original access control policy relating tosource 215, or may be the most current access control policy relating tosource 215. In other words, the second access control policy may override any previous access control policy in place.
Thus, embodiments of the present technology enable the prevention of continued harmful behavior on a network by providing a mechanism for detecting anomalous or harmful behavior by a user and/or a machine and restricting the user and/or the machine's future network access rights.
Although the subject matter has been described in a language specific to structural features and/or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims.
Claims (14)
1. A computer implemented method of managing security in a network, said method comprising:
detecting a data anomaly at a first location on a network;
identifying a source of said data anomaly;
determining a role-based authentication of said source, wherein said determining said role-based authentication of said source comprises:
determining a role associated with said source, wherein said role is a pre-defined function within said network, wherein said function corresponds to a level of access permitted to said source to various locations within said network;
comparing said source with a plurality of access control policies, wherein each of said plurality of access control policies comprises at least one access restriction instruction associated with one or more sources;
based on said comparing, associating said source with a corresponding one of said plurality of control policies, wherein said corresponding one of said plurality of control policies references at least said role of said source;
based on said identifying said source, replacing said corresponding one of said plurality of control policies with a second access control policy wherein said second access control policy overrides said corresponding one of said plurality of control policies and other previous access control policies in place; and
enabling a prevention of re-entry of said source at a second location on said network based on a network address of said source and based on said role-based authentication of said source.
2. The method ofclaim 1 , wherein said identifying a source of said data anomaly comprises:
mapping said source to an associated network address.
3. The method ofclaim 1 , wherein said associating said source with a corresponding one of said plurality of control policies comprises:
enabling a duration restriction on said access.
4. The method ofclaim 1 , wherein said associating said source with a corresponding one of said plurality of control policies comprises:
enabling a limiting of bandwidth usage by said source.
5. The method ofclaim 1 , further comprising:
associating a temporary access control policy with said source.
6. The method ofclaim 1 , further comprising:
associating a permanent access control policy with said source.
7. A non-transitory computer usable storage medium having computer readable program code embedded therein for a network security system, the program code comprising:
an anomaly detection module to detect a data anomaly at a first location on a network;
a source identifier to identify a source of said data anomaly;
a source authenticator to determine a role associated with said source, wherein said role is a pre-defined function within said network, wherein said function corresponds to a level of access permitted to said source to various locations within said network;
a data store to store a plurality of access control policies;
a source comparator to compare said source with said plurality of access control policies, wherein each of said plurality of access control policies comprises at least one access restriction instruction associated with one or more sources, and
an access control policy associator to associate said source with a corresponding one of said plurality of access control policies based on said comparing, wherein said corresponding one of said plurality of control policies references at least said role of said source, and to replace said corresponding one of said plurality of control policies with a second access control policy based on said indentifying said source wherein said second access control policy overrides said corresponding one of said plurality of control policies and other previous access control policies in place and to prevent re-entry of said source at a second location on said network based on a network address of said source and based on said role-based authentication of said source.
8. The program code ofclaim 7 , further comprising:
a mapping module configured for mapping said source to an associated network address.
9. The program code ofclaim 7 , wherein said access restriction instruction comprises a network location restriction for said source.
10. The program code ofclaim 7 , wherein said access restriction instruction comprises a network bandwidth restriction for said source at said second location.
11. The program code ofclaim 7 , wherein said access restriction instruction comprises a duration restriction for said source at said second location.
12. A computer usable storage medium comprising instructions that when executed cause a computer system to perform a method of managing security in a network, said method comprising:
determining a source of a detected data anomaly at a first location on a network;
determining a role-based authentication of said source, wherein said determining said role-based authentication of said source comprises:
determining a role associated with said source, wherein said role is a pre-defined function within said network, wherein said function corresponds to a level of access permitted to said source to various locations within said network;
comparing said source with a plurality of access control policies, wherein each of said plurality of access control policies comprises at least one access restriction instruction associated with one or more sources;
based on said comparing, associating said source with a corresponding one of said plurality of access control policies, wherein said corresponding one of said plurality of control policies references at least said role of said source;
based on said determining said source, replacing said corresponding one of said plurality of control policies with a second access control policy wherein said second access control policy overrides said corresponding one of said plurality of control policies and other previous access control policies in place; and
enabling a prevention of re-entry of said source at a second location on said network based on a network address of said source and based on said role-based authentication of said source.
13. The computer usable storage medium ofclaim 12 , wherein in said method, said determining comprises:
detecting a data anomaly at a first location on a network; and
identifying a source of said data anomaly.
14. The computer usable storage medium ofclaim 13 , wherein in said method, said identifying comprises:
mapping said source to an associated network address.
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| PCT/US2009/032501WO2010087838A1 (en) | 2009-01-29 | 2009-01-29 | Managing security in a network |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| US20110289557A1 US20110289557A1 (en) | 2011-11-24 |
| US9032478B2true US9032478B2 (en) | 2015-05-12 |
Family
ID=42395887
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| US13/146,112Active2029-06-10US9032478B2 (en) | 2009-01-29 | 2009-01-29 | Managing security in a network |
Country Status (4)
| Country | Link |
|---|---|
| US (1) | US9032478B2 (en) |
| EP (1) | EP2382575A4 (en) |
| CN (1) | CN102369532B (en) |
| WO (1) | WO2010087838A1 (en) |
Cited By (16)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US10560467B2 (en)* | 2016-08-26 | 2020-02-11 | Fujitsu Limited | Non-transitory computer-readable recording medium storing control program, control method, and information processing device |
| US10594713B2 (en) | 2017-11-10 | 2020-03-17 | Secureworks Corp. | Systems and methods for secure propagation of statistical models within threat intelligence communities |
| US10735470B2 (en) | 2017-11-06 | 2020-08-04 | Secureworks Corp. | Systems and methods for sharing, distributing, or accessing security data and/or security applications, models, or analytics |
| US10785238B2 (en) | 2018-06-12 | 2020-09-22 | Secureworks Corp. | Systems and methods for threat discovery across distinct organizations |
| US10841337B2 (en) | 2016-11-28 | 2020-11-17 | Secureworks Corp. | Computer implemented system and method, and computer program product for reversibly remediating a security risk |
| US11003718B2 (en) | 2018-06-12 | 2021-05-11 | Secureworks Corp. | Systems and methods for enabling a global aggregated search, while allowing configurable client anonymity |
| US11310268B2 (en) | 2019-05-06 | 2022-04-19 | Secureworks Corp. | Systems and methods using computer vision and machine learning for detection of malicious actions |
| US11381589B2 (en) | 2019-10-11 | 2022-07-05 | Secureworks Corp. | Systems and methods for distributed extended common vulnerabilities and exposures data management |
| US11418524B2 (en) | 2019-05-07 | 2022-08-16 | SecureworksCorp. | Systems and methods of hierarchical behavior activity modeling and detection for systems-level security |
| US11522877B2 (en) | 2019-12-16 | 2022-12-06 | Secureworks Corp. | Systems and methods for identifying malicious actors or activities |
| US11528294B2 (en) | 2021-02-18 | 2022-12-13 | SecureworksCorp. | Systems and methods for automated threat detection |
| US20230030504A1 (en)* | 2019-12-19 | 2023-02-02 | Siemens Mobility GmbH | Transmission device for transmitting data |
| US11588834B2 (en) | 2020-09-03 | 2023-02-21 | Secureworks Corp. | Systems and methods for identifying attack patterns or suspicious activity in client networks |
| US12015623B2 (en) | 2022-06-24 | 2024-06-18 | Secureworks Corp. | Systems and methods for consensus driven threat intelligence |
| US12034751B2 (en) | 2021-10-01 | 2024-07-09 | Secureworks Corp. | Systems and methods for detecting malicious hands-on-keyboard activity via machine learning |
| US12135789B2 (en) | 2021-08-04 | 2024-11-05 | Secureworks Corp. | Systems and methods of attack type and likelihood prediction |
Families Citing this family (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US8813172B2 (en) | 2011-12-16 | 2014-08-19 | Microsoft Corporation | Protection of data in a mixed use device |
| US20160182536A1 (en)* | 2014-12-19 | 2016-06-23 | Ca, Inc. | Adapting user terminal application operation responsive to measured user behavior |
Citations (12)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20060037075A1 (en)* | 2004-03-10 | 2006-02-16 | Frattura David E | Dynamic network detection system and method |
| KR20060017109A (en) | 2004-08-20 | 2006-02-23 | (주)한드림넷 | Network protection devices and methods |
| US20060150238A1 (en)* | 2005-01-04 | 2006-07-06 | Symbol Technologies, Inc. | Method and apparatus of adaptive network policy management for wireless mobile computers |
| US20060174342A1 (en)* | 2005-02-01 | 2006-08-03 | Khurram Zaheer | Network intrusion mitigation |
| EP1742438A1 (en) | 2005-07-05 | 2007-01-10 | Zyxel Communications Corporation | Network device for secure packet dispatching via port isolation |
| US20070033650A1 (en) | 2005-08-05 | 2007-02-08 | Grosse Eric H | Method and apparatus for defending against denial of service attacks in IP networks by target victim self-identification and control |
| US20070110069A1 (en) | 2005-11-12 | 2007-05-17 | Electronics And Telecommunications Research Institute | Method of blocking network attacks using packet information and apparatus thereof |
| US20070150934A1 (en) | 2005-12-22 | 2007-06-28 | Nortel Networks Ltd. | Dynamic Network Identity and Policy management |
| US20070157306A1 (en) | 2005-12-30 | 2007-07-05 | Elrod Craig T | Network threat detection and mitigation |
| US20070192862A1 (en)* | 2004-05-12 | 2007-08-16 | Vincent Vermeulen | Automated containment of network intruder |
| US20070214352A1 (en) | 2006-03-10 | 2007-09-13 | Sean Convery | Role aware network security enforcement |
| US20080235755A1 (en)* | 2007-03-22 | 2008-09-25 | Mocana Corporation | Firewall propagation |
- 2009
- 2009-01-29USUS13/146,112patent/US9032478B2/enactiveActive
- 2009-01-29EPEP09839411.7Apatent/EP2382575A4/ennot_activeWithdrawn
- 2009-01-29CNCN200980158441.1Apatent/CN102369532B/enactiveActive
- 2009-01-29WOPCT/US2009/032501patent/WO2010087838A1/enactiveApplication Filing
Patent Citations (12)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20060037075A1 (en)* | 2004-03-10 | 2006-02-16 | Frattura David E | Dynamic network detection system and method |
| US20070192862A1 (en)* | 2004-05-12 | 2007-08-16 | Vincent Vermeulen | Automated containment of network intruder |
| KR20060017109A (en) | 2004-08-20 | 2006-02-23 | (주)한드림넷 | Network protection devices and methods |
| US20060150238A1 (en)* | 2005-01-04 | 2006-07-06 | Symbol Technologies, Inc. | Method and apparatus of adaptive network policy management for wireless mobile computers |
| US20060174342A1 (en)* | 2005-02-01 | 2006-08-03 | Khurram Zaheer | Network intrusion mitigation |
| EP1742438A1 (en) | 2005-07-05 | 2007-01-10 | Zyxel Communications Corporation | Network device for secure packet dispatching via port isolation |
| US20070033650A1 (en) | 2005-08-05 | 2007-02-08 | Grosse Eric H | Method and apparatus for defending against denial of service attacks in IP networks by target victim self-identification and control |
| US20070110069A1 (en) | 2005-11-12 | 2007-05-17 | Electronics And Telecommunications Research Institute | Method of blocking network attacks using packet information and apparatus thereof |
| US20070150934A1 (en) | 2005-12-22 | 2007-06-28 | Nortel Networks Ltd. | Dynamic Network Identity and Policy management |
| US20070157306A1 (en) | 2005-12-30 | 2007-07-05 | Elrod Craig T | Network threat detection and mitigation |
| US20070214352A1 (en) | 2006-03-10 | 2007-09-13 | Sean Convery | Role aware network security enforcement |
| US20080235755A1 (en)* | 2007-03-22 | 2008-09-25 | Mocana Corporation | Firewall propagation |
Non-Patent Citations (4)
| Title |
|---|
| Damianou et al. ‘The Ponder Policy Specification Language’. Proc. Policy 5-8, 14, 15 2001: Workshop on Policies for Distributed Systems and Networks, Bristol, UK, Jan. 29-31, 2001. |
| Damianou et al. 'The Ponder Policy Specification Language'. Proc. Policy 5-8, 14, 15 2001: Workshop on Policies for Distributed Systems and Networks, Bristol, UK, Jan. 29-31, 2001. |
| Extended European Search Report, Apr. 24, 2013, EP Patent Application No. 09839411.7. |
| International Search Report, PCT/US2009/032501, Jul. 28, 2009. |
Cited By (20)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US10560467B2 (en)* | 2016-08-26 | 2020-02-11 | Fujitsu Limited | Non-transitory computer-readable recording medium storing control program, control method, and information processing device |
| US11665201B2 (en) | 2016-11-28 | 2023-05-30 | Secureworks Corp. | Computer implemented system and method, and computer program product for reversibly remediating a security risk |
| US10841337B2 (en) | 2016-11-28 | 2020-11-17 | Secureworks Corp. | Computer implemented system and method, and computer program product for reversibly remediating a security risk |
| US11632398B2 (en) | 2017-11-06 | 2023-04-18 | Secureworks Corp. | Systems and methods for sharing, distributing, or accessing security data and/or security applications, models, or analytics |
| US10735470B2 (en) | 2017-11-06 | 2020-08-04 | Secureworks Corp. | Systems and methods for sharing, distributing, or accessing security data and/or security applications, models, or analytics |
| US10594713B2 (en) | 2017-11-10 | 2020-03-17 | Secureworks Corp. | Systems and methods for secure propagation of statistical models within threat intelligence communities |
| US11003718B2 (en) | 2018-06-12 | 2021-05-11 | Secureworks Corp. | Systems and methods for enabling a global aggregated search, while allowing configurable client anonymity |
| US10785238B2 (en) | 2018-06-12 | 2020-09-22 | Secureworks Corp. | Systems and methods for threat discovery across distinct organizations |
| US11044263B2 (en) | 2018-06-12 | 2021-06-22 | Secureworks Corp. | Systems and methods for threat discovery across distinct organizations |
| US11310268B2 (en) | 2019-05-06 | 2022-04-19 | Secureworks Corp. | Systems and methods using computer vision and machine learning for detection of malicious actions |
| US11418524B2 (en) | 2019-05-07 | 2022-08-16 | SecureworksCorp. | Systems and methods of hierarchical behavior activity modeling and detection for systems-level security |
| US11381589B2 (en) | 2019-10-11 | 2022-07-05 | Secureworks Corp. | Systems and methods for distributed extended common vulnerabilities and exposures data management |
| US11522877B2 (en) | 2019-12-16 | 2022-12-06 | Secureworks Corp. | Systems and methods for identifying malicious actors or activities |
| US12375320B2 (en)* | 2019-12-19 | 2025-07-29 | Siemens Mobility GmbH | Transmission device for transmitting data and detecting anomalies |
| US20230030504A1 (en)* | 2019-12-19 | 2023-02-02 | Siemens Mobility GmbH | Transmission device for transmitting data |
| US11588834B2 (en) | 2020-09-03 | 2023-02-21 | Secureworks Corp. | Systems and methods for identifying attack patterns or suspicious activity in client networks |
| US11528294B2 (en) | 2021-02-18 | 2022-12-13 | SecureworksCorp. | Systems and methods for automated threat detection |
| US12135789B2 (en) | 2021-08-04 | 2024-11-05 | Secureworks Corp. | Systems and methods of attack type and likelihood prediction |
| US12034751B2 (en) | 2021-10-01 | 2024-07-09 | Secureworks Corp. | Systems and methods for detecting malicious hands-on-keyboard activity via machine learning |
| US12015623B2 (en) | 2022-06-24 | 2024-06-18 | Secureworks Corp. | Systems and methods for consensus driven threat intelligence |
Also Published As
| Publication number | Publication date |
|---|---|
| CN102369532A (en) | 2012-03-07 |
| WO2010087838A1 (en) | 2010-08-05 |
| EP2382575A4 (en) | 2013-05-22 |
| CN102369532B (en) | 2015-05-20 |
| US20110289557A1 (en) | 2011-11-24 |
| EP2382575A1 (en) | 2011-11-02 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US9032478B2 (en) | Managing security in a network | |
| US11100232B1 (en) | Systems and methods to automate networked device security response priority by user role detection | |
| US9516062B2 (en) | System and method for determining and using local reputations of users and hosts to protect information in a network environment | |
| US10068095B1 (en) | Systems and methods for selecting a termination rule for a penetration testing campaign | |
| US12244624B2 (en) | Malware detection at endpoint devices | |
| US9672348B2 (en) | Risk-based credential management | |
| US9092616B2 (en) | Systems and methods for threat identification and remediation | |
| US8122503B2 (en) | Methods and systems for managing a potential security threat to a network | |
| US9185122B2 (en) | Methods and systems for managing security in a network | |
| US20180173876A1 (en) | Deceiving attackers in endpoint systems | |
| US10320829B1 (en) | Comprehensive modeling and mitigation of security risk vulnerabilities in an enterprise network | |
| US12346446B2 (en) | Detecting and preventing installation and execution of malicious browser extensions | |
| US9356932B2 (en) | Dynamically applying a control policy to a network | |
| US10313384B1 (en) | Mitigation of security risk vulnerabilities in an enterprise network | |
| US20250254199A1 (en) | Cloud asset misconfiguration risk detection and prevention | |
| WO2024059722A1 (en) | Application layer security policy implementation | |
| Hooper | Cybersecurity for media technology products |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| AS | Assignment | Owner name:HEWLETT-PACKARD DEVELOPMENT COMPANY, L.P., TEXAS Free format text:ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:BALLESTEROS, REBECCA M;KRELL, SHERRY;COWHAM, ADRIAN;AND OTHERS;REEL/FRAME:027017/0046 Effective date:20090128 | |
| AS | Assignment | Owner name:HEWLETT-PACKARD DEVELOPMENT COMPANY, L.P., TEXAS Free format text:ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:BALLESTEROS, REBECCA M.;KRELL, SHERRY;COWHAM, ADRIAN;AND OTHERS;REEL/FRAME:027100/0217 Effective date:20090128 | |
| STCF | Information on status: patent grant | Free format text:PATENTED CASE | |
| AS | Assignment | Owner name:HEWLETT PACKARD ENTERPRISE DEVELOPMENT LP, TEXAS Free format text:ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:HEWLETT-PACKARD DEVELOPMENT COMPANY, L.P.;REEL/FRAME:037079/0001 Effective date:20151027 | |
| MAFP | Maintenance fee payment | Free format text:PAYMENT OF MAINTENANCE FEE, 4TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1551); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY Year of fee payment:4 | |
| MAFP | Maintenance fee payment | Free format text:PAYMENT OF MAINTENANCE FEE, 8TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1552); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY Year of fee payment:8 |